Remodeling for Compliance: How to Address Content Compliance
In today's hot real estate markets, many homeowners are remodeling their existing properties instead of moving. As a result, architects and builders are swamped in their efforts to meet the needs of many homeowners for "new" redesigned homes. Similarly, many organizations are faced with having to remodel their existing technology architecture to comply with the ever-increasing number of legal, privacy and regulatory requirements relating to the management of content. Because of pressing regulatory mandates such as Sarbanes-Oxley, HIPAA, The USA PATRIOT Act and the Gramm-Leach-Bliley Act, content compliance, or the management of various sources of unstructured content in a manner that meets both external and internal compliance requirements, is top of mind for many organizations. In most organizations, information is stored on a variety of unconnected or only loosely connected systems such as accounting, enterprise resource planning, customer relationship management, supply chain management, legal, human resources, e-mail and engineering files, among others. Ideally, the systems should adhere to an overarching plan or design, like the blueprint for a house. The unfortunate reality is that such systems have been implemented over time to meet different business needs, so the challenge for organizations is to bring together content from these disparate systems and archives, and manage it intelligently from a compliance perspective.
One approach to content compliance is for an organization to use a "black box" approach and store everything, regardless of context. In terms of remodeling, this is akin to an architect incorporating everything that a homeowner wants in the design without regard to basic design principles. For an organization, such catch-all archives may actually become a source of risk and liability. The search and retrieval of relevant content for business purposes becomes difficult and expensive—if not impossible—and the organization may end up storing content that should be destroyed under legal or records management principles.
A Smarter Approach
Effective content compliance first involves bringing together only content of business value into an enterprise content management and records management system. This approach establishes a content compliance foundation from which organizations can build out compliance tool layers and enforce various policies for compliance. For example, e-mail archiving is a critical compliance initiative for most organizations. However, most automated e-mail solutions tend to catch everything, and store it in a standalone information silo, isolated from other business content. A better approach is to automatically and selectively archive only relevant business records, then link the archive directly to a records management system for both compliance and business continuity requirements.
While the overall design or technology foundation is critical for content compliance, a culture of compliance also needs to be established, otherwise even the most sophisticated compliance strategy may fail, ultimately. Organizations must embed a philosophy of compliance into the fabric of their organizations by creating, communicating and enforcing compliance policies. In fact, according to the U.S. Sentencing Commission's Federal Sentencing Guidelines, stiff penalties may result if an organizational culture that conveys the adoption of effective compliance and ethics programs is not effectively promoted.
Technology Plus Training
To help promote and establish such cultural changes (in addition to ongoing employee education), organizations should use a combination of technology and methodology to implement and automate processes, enforce policies and manage content. For instance, organizations can implement tools that automate the capture and declaration of corporate records, whether e-mail, documents or other content. Security tools can prevent noncompliant content from leaving the organization (or non-business content from being captured) and integrated workflow systems can simplify compliance monitoring of e-mail and instant messages. These tools can also be expanded to prevent the accidental or deliberate disclosure of corporate intellectual property to unauthorized external parties. By implementing such supportive compliance tools around a central enterprise content and records management system, organizations can ensure that both compliance and business requirements are effectively met.
Remodeling—whether a house or an organization—requires a balance between short-term necessities and long-term requirements. In terms of content compliance, organizations must strive for the right balance between meeting compliance requirements and managing their content in a business-effective manner. By keeping the overall compliance design in mind, an organization can achieve both compliance as well as operational improvements and create, ultimately, a more competitive business model, all under one "roof."
Yaletown Technology Group Inc. (YTG) provides content compliance infrastructure to ensure that e-mail, instant messages, intellectual property and documents are managed using records management best practices and tools. With fifteen years experience, and the most innovative approach anywhere, YTG has solutions deployed in companies worldwide.